Templates, few-shot and humans

ZS — ZeroShot

An attacker LLM is shown the behavior (and, for a contextual behavior, its context passage) and asked to write prompts that elicit it; the reply is prefilled with an affirmative opener as a numbered list, sampling stops at the first newline, so each call yields one candidate. No feedback: the target is never called during generation, so this runs against API-only targets.

Attack model mistralai/Mixtral-8x7B-Instruct-v0.1 on 2 GPUs via vLLM at temperature 0.9, top_p 0.95, presence_penalty / frequency_penalty 0.1, max_tokens 256; num_test_cases_per_behavior: 5 overrides the class default of 100. Pipeline row mixtral_attacker_llm, behavior_chunk_size: 100: four chunks over the 400 text behaviors. For contextual behaviors the passage is stitched onto the front of the generated line.

At 25.4 it is indistinguishable from asking plainly (0.1 points, against a grader with ~7% label noise). On closed targets it is often the best cheap method: GPT-4 0613 19.4; on Claude 2.1 its 4.1 is the highest cell in all sixteen columns. On many it is worse than nothing: 33.0 → 28.4 on GPT-3.5 Turbo 1106, 18.0 → 14.8 on Gemini Pro, 65.8 → 60.0 on Zephyr 7B, because a rewrite that drifts off the behavior is scored a failure even when the model complied, the flaw Table 4's third prequalification set exposes in rival classifiers.

Reimplemented from Perez et al. 2022, Red Teaming Language Models with Language Models (arXiv:2202.03286) with an adjusted prompt, per §C.1.

SFS — Stochastic Few-Shot

The loop: ask the same Mixtral model for ten variation prompts; dedupe and discard anything under 32 characters; run each survivor through the target and score by mean cross-entropy on a fixed affirmative continuation from data/optimizer_targets/harmbench_targets_text.json; hand the five lowest-loss back as few-shot examples, up to 50 rounds. The returned test case is the single lowest-loss candidate.

That target file is the one GCG optimises against: SFS is GCG's objective with the gradient removed and an LLM sampler in its place, steered by its own best-scoring outputs. It needs logits, hence allowed_target_model_types: [open_source], but never a backward pass.

Knobs: sample_size: 64 per step, n_shots: 5, num_steps: 50; generation at temperature 1.0, top_p 1.0, presence_penalty / frequency_penalty 0.1, max_tokens 1024, a stop string capping each call at ten numbered lines. Separate templates for plain and contextual behaviors; contextual candidates get the passage prepended before scoring. behavior_chunk_size: 5, base_num_gpus: 2.

Three things stop the loop: the shots stop changing, no new candidate survives filtering, or the current best yields a completion that does not look like a refusal. That check greedily generates 32 tokens and tests them against 35 refusal substrings, the AdvBench-style heuristic Table 4 shows is a bad grader. It cannot inflate the score: ASR is still the Llama 2 13B classifier over 512 tokens.

38.3 beats UAT (30.8), GBDA (29.8) and PEZ (29.0), all white box, and matches GCG-Transfer at 38.8. By slice: 44.3 standard, 56.5 contextual, 6.6 copyright. Against Zephyr 7B + R2D2, adversarially trained until GCG fell from 69.5 to 5.5, SFS still lands 43.5.

"For some attacks, the improvement conferred by R2D2 is less pronounced. This is especially true for methods dissimilar to the train-time GCG adversary, including PAIR, TAP, and Stochastic Few-Shot."— HarmBench, §6.2

Same origin as ZeroShot, but §C.1 is explicit this is not the original: the authors "use an iterative version of the Stochastic Few-Shot method to increase the probability of the target LLM generating a target string". The loss-guided iteration is HarmBench's addition, so 38.3 is HarmBench's variant.

Human — Human Jailbreaks

The corpus is one Python list, JAILBREAKS: 114 entries, about 226,000 characters, median around 1,400 and longest around 16,000. In-the-wild Do Anything Now templates (persona, fictional-wrapper, rule-override framings); this site reproduces none of them.

Construction: template, blank line, behavior string, contextual passages joined first via the same \n\n---\n\n separator DirectRequest uses. Nothing adapts per model, behavior or response. The reported column is random_subset_5 with seed: 1, reshuffled inside the per-behavior loop, so each behavior draws a different five of the 114, deterministically. behavior_chunk_size: all_behaviors, base_num_gpus: 0, both target types.

An all_jailbreaks experiment exists (random_subset: -1); its HumanJailbreaks-all pipeline row is commented out as expensive on closed models: 113 templates × 400 behaviors is about 45,000 completions at 512 tokens. 113 not 114 because -1 is an integer, so JAILBREAKS[:-1] drops the shuffled list's last entry, an off-by-one that never touches the reported column.

At 27.3 the whole corpus is worth 2.0 points over asking plainly (31.9 standard, 41.4 contextual, 4.3 copyright). Across two revisions of one closed model the column falls off a cliff: GPT-3.5 Turbo 0613 24.5 vs 1106 2.8; GPT-4 0613 11.3 vs Turbo 1106 2.6; the three Claude models 2.4, 0.3, 0.3.

Five unadapted 2023 templates thrown at later models, scored on the mean of the five, measures do the famous jailbreaks still work (largely no), not can a human jailbreak this model, which needs a person adapting after each refusal, something HarmBench asks of none of its 18 methods. Source: Shen et al. 2023, "Do Anything Now" (arXiv:2308.03825).

ArtPrompt

ArtPrompt has no HarmBench ASR number. It appears in neither the arXiv v2 text nor any result table, and the headline grid's sixteen attack columns exclude it. It is a later addition to the repository's method set, which is why the repo's 21 method configs and 24 active pipeline entries exceed the paper's 18 methods.

Mechanism: a masking model picks the single word carrying the sensitive load; that word becomes a placeholder re-presented as ASCII art, so a safety layer reading text never sees it while a model that reads the rendering recovers it.

Config: masking_model: gpt-4-0613, and masking_model_key is required (the constructor raises without it), so despite base_num_gpus: 0 it needs an OpenAI account. masking_direction: horizontal by default, vertical available; fontname: cards from a six-item list (gen, alphabet, letters, keyboard, cards, puzzle), the intersection of the two renderers (horizontal implements eleven fonts, vertical six). behavior_chunk_size: 5, both target types.

Only the first mask word is used (a code comment says multi-word masking is unsupported); candidates containing a space are discarded, and if none survives the test case falls back to the plain behavior string, silently degrading to DirectRequest. A mask word that is not a literal substring raises. Vestigial optimiser plumbing remains: targets_path is loaded but never read, and each log entry records loss=0.

Source: Jiang et al. 2024, ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs (arXiv:2402.11753), which also introduces the ViTC (Vision-in-Text Challenge) benchmark the class names refer to.

DR — DirectRequest

The whole method config is placeholder: placeholder, twice: generate_test_cases returns the Behavior string. Pipeline row: experiment_name_template: default, behavior_chunk_size: all_behaviors, base_num_gpus: 0, both model types. Step 1 of the pipeline is CPU string formatting; the cost lives in generation and classification.

For a contextual behavior it does not send the behavior alone, but ContextString, then \n\n---\n\n, then the behavior. That join is shared by Human Jailbreaks, ZeroShot and SFS, an undocumented convention of the method set; a harness that sends just the behavior is not running DirectRequest.

"This tests how well models can refuse direct requests to engage in the behaviors when the requests are not obfuscated in any way and often suggest malicious intent."— HarmBench, §C.1

25.3 average, but the per-model range is the finding: 0.8 on Llama 2 7B Chat, 65.8 on Zephyr 7B; beside them SOLAR 10.7B-Instruct 61.3 and Mistral 7B 46.3, against 2.8 for both the 13B and 70B Llama 2 Chat models. Refusal training, not scale, separates them, the point the results page makes across the grid.

By slice, 23.9 standard / 46.2 contextual / 7.3 copyright. Contextual nearly doubles standard: 46% succeed with no attack, the paper's Figure 11 claim that harder-to-look-up behaviors are easier to elicit. On Copyright Violations, DirectRequest's 7.3 beats GCG's 4.6 and every gradient column: the MinHash grader only fires on near-verbatim regurgitation, and optimisation pushes a model off verbatim reproduction. (Recomputed averages: the printed Average row in the v2 sub-table contradicts its own cells; see the discrepancy note.)

Its multimodal twin MultiModalDirectRequest scores 69.09 on LLaVA 1.5 and 16.36 on GPT-4V over the 110 multimodal behaviors.